Sign-in and access
Sentinel is not open to the public. Approved installers sign in with their work email, secured by Cloudflare Access — there is no self-serve signup. Ron approves each installer and can disable an account at any time from an admin console, so every live session belongs to a known, currently-approved engineer.
The audit log
Sentinel is read-only by default. When an engineer requests a write, the command is recorded to a tamper-evident audit log before it is relayed to the inverter:
- Append-only and hash-chained per system — each entry links to the one before it, so no engineer can alter, delete or reorder a record after the fact without breaking the chain. Only the account owner can erase an entire system's record (for example to clear a test), and every erasure is itself permanently logged.
- Logged before relay — the write is written to the log first; only then is the command passed on to the agent and the inverter.
- Fail-closed — if the change cannot be recorded, it is refused. No log, no write.
- Keyed to the engineer and the system — every entry records which signed-in engineer made the change and which system it targeted.
Separately, and enforced on the customer's own device, no write happens without access the customer granted: either a short window they allow during a call, or a 48-hour grant they create themselves. The agent refuses any write outside one of those, and a revocation takes effect immediately rather than at the end of a session.
The audit log records which consent route was behind each write. Every row carries a consent_source of customer_device or unverified, inside the hash-chained record rather than beside it, so the distinction cannot be edited after the fact. This page previously said that capturing on-device approval in the log was “planned but not yet in place” — that was out of date and understated what the log holds; corrected 27 September 2026.
Report a vulnerability
If you believe you have found a security vulnerability in Sentinel — the agent, the cloud API, the dashboard, the pairing flow, or any other surface — please email hello@sentinelapp.solar with subject line beginning "SECURITY:".
Include enough detail for us to reproduce — affected version, steps to reproduce, expected vs actual behaviour, and what you believe the impact is. PGP-encrypted reports welcome on request.
What we promise
- Acknowledgement within 2 business days.
- Initial assessment within 5 business days.
- Coordinated disclosure timeline agreed in writing.
- No legal action against good-faith reporters who follow this policy.
- Public credit (with your permission) once a fix has shipped.
Scope
In scope: sentinelapp.solar, the Sentinel agent (all distribution channels), the Cloudflare Worker / Durable Object infrastructure, the pairing flow, and any official Sentinel mobile or desktop client.
Out of scope: social engineering, physical attacks, denial-of-service tests against production infrastructure, attacks against third-party services (Cloudflare, etc.) that we depend on.
Safe-harbour
If you make a good-faith effort to comply with this policy during your research, we will consider your research authorised, work with you to understand and resolve the issue quickly, and not pursue legal action against you. If a third party (e.g. law enforcement) initiates action while you are complying with this policy, we will make our position clear.
Last updated 01 July 2026.